fix(mcp): fix SSE streaming crash and reduce get_canvas token usage

- Replace BaseHTTPMiddleware with pure ASGI middleware in auth.py to fix
  the "Unexpected message: http.response.start" crash on SSE streams
- Migrate from SseServerTransport to StreamableHTTPSessionManager in main.py
- Add _slim_canvas() in tools.py to strip React Flow layout fields from
  get_canvas responses (60-80% payload reduction)
- Update tests: assert canvas slimming, mock session_manager.handle_request
  in auth tests to avoid uninitialized task group errors

mcp/tests/test_auth.py

@@ -1,4 +1,5 @@
 import pytest
+from unittest.mock import AsyncMock, patch
 
 
 @pytest.mark.anyio
@@ -21,6 +22,7 @@ async def test_wrong_api_key(client):
 
 @pytest.mark.anyio
 async def test_valid_api_key_passes(client, api_key):
-    # SSE endpoint returns 200 with valid key (even if stream is incomplete in tests)
-    resp = await client.get("/mcp", headers={"X-API-Key": api_key})
+    # Auth passes — mock handle_request so we don't need a live MCP session
+    with patch("app.main.session_manager.handle_request", new_callable=AsyncMock):
+        resp = await client.get("/mcp", headers={"X-API-Key": api_key})
     assert resp.status_code != 401